CVE-2024-4295

CVE-2024-4295 affects the WordPress plugin Email Subscribers by Icegram Express . It is an unauthenticated SQL injection via the hash parameter in all versions up to 5.7.20 caused by insufficient escaping and poor SQL query preparation. Exploitation could enable attackers to append additional SQL...

CVE-2024-1161

CVE-2024-1161 applies to the Brizy – Page Builder for WordPress. It is a Stored XSS in the plugin’s Custom Attributes for blocks, caused by insufficient input sanitization and output escaping in all versions up to 2.4.43. Exploitation requires authentication at contributor level or higher, allowi...

CVE-2024-5149

The vulnerability CVE-2024-5149 affects the BuddyForms WordPress plugin (all versions up to and including 2.8.9). It enables an Email Verification Bypass due to an insufficiently random activation code, allowing unauthenticated attackers to bypass email verification. Wordfence reports this issue ...

CVE-2024-5262

CVE-2024-5262 concerns a vulnerability in the SMB server component of ProjectDiscovery Interactsh. Technical details in connected sources identify that remote attackers can read/write any files within the directory and subdirectories where the interactsh-server runs, via anonymous login. This con...

CVE-2024-5483

LearnPress – WordPress LMS Plugin (LearnPress) CVE-2024-5483: Sensitive Information Exposure in all versions up to 4.2.6.8 due to an incorrect implementation of get_items_permissions_check, allowing unauthenticated attackers to retrieve basic user data, including emails. Remediation provided by c...

CVE-2024-5317

CVE-2024-5317 affects the Newsletter – Send awesome emails from WordPress plugin. It remains vulnerable to Stored XSS via the np1 parameter in all versions up to 8.3.4 due to insufficient input sanitization and output escaping. The issue allows unauthenticated attackers to inject script code into...

CVE-2024-5636

CVE-2024-5636 affects itsourcecode Bakery Online Ordering System 1.0. The vulnerability is in the file report/index.php, where manipulation of the argument procduct leads to SQL injection. The issue is exploitable remotely and has been publicly disclosed. Documentation lists high-severity impact ...

CVE-2024-4084

CVE-2024-4084 affects mintplex-labs/anything-llm. The issue is a Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, enabling access to internal assets and services. Attackers can bypass intranet IP filters (192/172/10/127) and protocol restrictions by using a...

CVE-2023-50804

CVE-2023-50804 concerns Samsung baseband/modem software in Exynos devices where NAS (Non-Access‑Stratum) format type checking is insufficient, enabling authentication bypass in the baseband stack. The issue affects multiple Exynos SoCs (e.g., Exynos 9820/9825/980/990/850/1080/2100/2200/1280/1380/...

CVE-2023-49927

CVE-2023-49927 affects Samsung Mobile Processor, Wearable Processor, and Modem Exynos families (980, 990, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, and related modems). The baseband software fails to properly validate the RRC format types, leading to insufficient encryption. This is de...

CVE-2024-34055

CVE-2024-34055 affects Cyrus IMAPD before 3.8.3 and 3.10.x before 3.10.0-rc1. An attacker with authentication can trigger unbounded memory allocation by sending many LITERALs in a single command, enabling memory exhaustion (availability impact). Patches/releases: upgrade to Cyrus IMAPD 3.8.3 or 3...

CVE-2022-28658

CVE-2022-28658 concerns the Apport component of Ubuntu/Linux, where argument parsing mishandles filename splitting on older kernels, enabling local argument spoofing to the Apport daemon. The issue affects Apport’s handling of certain filenames and command-line arguments, with the published CVSS ...

CVE-2022-28657

CVE-2022-28657 concerns Apport, where the Python crash handler is not disabled before chroot, enabling a local attacker to exploit the issue. The vulnerability is described across multiple advisories (e.g., Ubuntu USN-6894-1) and related Nessus/OSV entries, all referencing the same root cause: Ap...

CVE-2024-5635

CVE-2024-5635 affects the itsourcecode Bakery Online Ordering System 1.0. The vulnerability is in an unknown function of the file index.php , where manipulating the argument txtsearch leads to SQL injection . The attack is executable remotely and the exploit has been disclosed publicly. Connected...

CVE-2022-28656

CVE-2022-28656 affects the Apport component in Ubuntu-derived environments. The vulnerability is described as: when is_closing_session() runs, it allows local users to consume RAM in the Apport process, which can lead to a local denial of service. The issue is disclosed and tracked across multipl...

CVE-2022-28655

CVE-2022-28655 affects the Apport component on Linux/Ubuntu, where is_closing_session() allows a local user to create arbitrary TCP D-Bus connections. The available documents describe a local attack surface with potential integrity and availability impact (I: High, A: High) while confidentiality ...

CVE-2022-28654

CVE-2022-28654 concerns the Apport component in Linux/Ubuntu. The is_closing_session() path allows an attacker to fill the apport.log, causing a denial of service or local resource exhaustion as described in multiple advisories. The vulnerability is locally exploitable with low privileges and doe...

CVE-2024-30889

AudimexEE (audimexEE) vulnerable to Cross Site Scripting in versions prior to 15.1.3.9. CVE-2024-30889 allows a remote attacker to execute arbitrary code via parameters service, method, widget_type, request_id, and payload. The fixed version is 15.1.3.9 (or later). No exploitation status is provi...

CVE-2022-28652

CVE-2022-28652 affects the Apport component, specifically ~/.config/apport/settings parsing. The vulnerability is described as a parsing issue (billion laughs) with local attack vector and a high availability impact in the NVD metrics. The connected records confirm affected product/area and the u...

CVE-2024-36675

LyLme_spage v1.9.5 is affected by SSRF via the url parameter in apply/index.php, as documented by the nuclei template and related sources. The vulnerability allows an attacker to force the server to make arbitrary requests, potentially reaching internal resources. Remediation: upgrade to a versio...